INTRODUCTION The purpose of an electrical power system is to generate and supply electrical energy to consumers.

The system should be designed and managed to deliver this energy to the utilization points with both reliability and economy. Severe disruption to the normal routine of modern society is likely if power outages are frequent or prolonged, placing an increasing emphasis on reliability and security of supply. As the requirements of reliability and economy are largely opposed, power system design is inevitably a compromise. A power system comprises many diverse items of equipment. Figure 1 shows a hypothetical power system.

at all times. No matter how well designed, faults will always occur on a power system, and these faults may represent a risk to life and/or property. The destructive power of a fault arc carrying a high current is very great; it can burn through copper conductors or weld together core laminations in a transformer or machine in a very short time some tens or hundreds of milliseconds. Even away from the fault arc itself, heavy fault currents can cause damage to plant if they continue for more than a few seconds. The provision of adequate protection to detect and disconnect elements of the power system in the event of fault is therefore an integral part of power system design. Only by so doing can the objectives of the power system be met and the investment protected. This is the measure of the importance of protection systems as applied in power system practice and of the responsibility vested in the Protection Engineer. PROTECTION EQUIPMENT The definitions that follow are generally used in relation to power system protection:
Protection System: a complete arrangement of protection equipment and other devices required to achieve a specified function based on a protection principal (IEC 60255-20)

fig 1 Many items of equipment are very expensive, and so the complete power system represents a very large capital investment. To maximise the return on this outlay, the system must be utilised as much as possible within the applicable constraints of security and reliability of supply. More fundamental, however, is that the power system should operate in a safe manner

Protection Equipment: a collection of protection devices (relays, fuses, etc.). Excluded are devices such as CTs, CBs, Contactors, etc. Protection Scheme: a collection of protection equipment providing a defined function and including all equipment required to make the scheme work (i.e. relays, CTs, CBs, batteries, etc.)

In order to fulfill the requirements of protection with the optimum speed for the many different configurations, operating conditions and construction features of power systems, it has been necessary to develop many types of relay that respond to various functions of the power system quantities. For example, observation simply of the magnitude of the fault current suffices in some cases but measurement of power or impedance may be necessary in others. Relays frequently measure complex functions of the system quantities, which are only readily expressible by mathematical or graphical means. Relays may be classified according to the technology used: a. Electromechanical b. Static c. Digital d. Numerical In many cases, it is not feasible to protect against all hazards with a relay that responds to a single power system quantity. An arrangement using several quantities may be required. In this case, either several relays, each responding to a single quantity, or, more commonly, a single relay containing several elements, each responding independently to a different quantity may be used. ZONES OF PROTECTION To limit the extent of the power system that is disconnected when a fault occurs, protection is arranged in zones. The principle is shown in Figure 2 Ideally, the zones of protection should overlap, so that no part of the power system is left unprotected. This is shown in Figure 3(a), the circuit breaker being included in both zones. Fig 2 For practical physical and economic reasons, this ideal is not always achieved, accommodation for current transformers being in some cases available only on one side of the circuit breakers, as in Figure 3 (b).

Fig 3 This leaves a section between the current transformers and the circuit

breaker A that is not completely protected against faults. In Figure 3 (b) a fault at F would cause the bus bar protection to operate and open the circuit breaker but the fault may continue to be fed through the feeder. The feeder protection, if of the unit type would not operate, since the fault is outside its zone. This problem is dealt with by inter tripping or some form of zone extension, to ensure that the remote end of the feeder is tripped also. The point of connection of the protection with the power system usually defines the zone and corresponds to the location of the current transformers. Unit type protection will result in the boundary being a clearly defined closed loop. Figure 4 illustrates a typical arrangement of overlapping zones.

that the system will operate under all required conditions, and (equally important) refrain from operating when so required (including, where appropriate, being restrained from operating for faults external to the zone being protected). Due consideration must be given to the nature, frequency and duration of faults likely to be experienced, all relevant parameters of the power system (including the characteristics of the supply source, and methods of operation) and the type of protection equipment used. Of course, no amount of effort at this stage can make up for the use of protection equipment that has not itself been subject to proper design. Settings It is essential to ensure that settings are chosen for protection relays and systems which take into account the parameters of the primary system, including fault and load levels, and dynamic performance requirements etc. The characteristics of power systems change with time, due to changes in loads, location, type and amount of generation, etc. Therefore, setting values of relays may need to be checked at suitable intervals to ensure that they are still appropriate. Otherwise, unwanted operation or failure to operate when required may occur. Installation The need for correct installation of protection systems is obvious, but the complexity of the interconnections of many systems and their relationship to the remainder of the installation may make checking difficult. Site testing is therefore necessary; since it will be difficult to reproduce all fault conditions correctly, these tests must be directed to proving the installation. The tests should be limited to such simple and

Fig 4 Alternatively, the zone may be unrestricted; the start will be defined but the extent (or reach) will depend on measurement of the system quantities and will therefore be subject to variation, owing to changes in system conditions and measurement errors. RELIABILITY Incorrect operation can be attributed to one of the following classifications: a. Incorrect design/settings b. Incorrect installation/testing c. Deterioration in service Design The design of a protection scheme is of paramount importance. This is to ensure

direct tests as will prove the correctness of the connections, relay settings, and freedom from damage of the equipment. No attempt should be made to 'type test' the equipment or to establish complex aspects of its technical performance. Testing Comprehensive testing is just as important, and this testing should cover all aspects of the protection scheme, as well as reproducing operational and environmental conditions as closely as possible. Type testing of protection equipment to recognized standards fulfils many of these requirements, but it may still be necessary to test the complete protection scheme (relays, current transformers and other ancillary items) and the tests must simulate fault conditions realistically. Deterioration in Service Subsequent to installation in perfect condition, deterioration of equipment will take place and may eventually interfere with correct functioning. For example, contacts may become rough or burnt owing to frequent operation, or tarnished owing to atmospheric contamination; coils and other circuits may become open-circuited, electronic components and auxiliary devices may fail, and mechanical parts may seize up. The time between operations of protection relays may be years rather than days. During this period defects may have developed unnoticed until revealed by the failure of the protection to respond to a power system fault. For this reason, relays should be regularly tested in order to check for correct functioning. Testing should preferably be carried out without disturbing permanent connections. This can be achieved by the provision of test blocks or switches. The quality of testing personnel is an essential feature when

assessing reliability and considering means for improvement. Staff must be technically competent and adequately trained, as well as self-disciplined to proceed in a systematic manner to achieve final acceptance. Important circuits that are especially vulnerable can be provided with continuous electrical supervision; such arrangements are commonly applied to circuit breaker trip circuits and to pilot circuits. Modern digital and numerical relays usually incorporate self-testing/ diagnostic facilities to assist in the detection of failures. With these types of relay, it may be possible to arrange for such failures to be automatically reported by communications link to a remote operations center, so that appropriate action may be taken to ensure continued safe operation of that part of the power system and arrangements put in hand for investigation and correction of the fault. Protection Performance Protection system performance is frequently assessed statistically. For this purpose each system fault is classed as an incident and only those that are cleared by the tripping of the correct circuit breakers are classed as 'correct'. The percentage of correct clearances can then be determined. This principle of assessment gives an accurate evaluation of the protection of the system as a whole, but it is severe in its judgement of relay performance. Many relays are called into operation for each system fault, and all must behave correctly for a correct clearance to be recorded. Complete reliability is unlikely ever to be achieved by further improvements in construction. If the level of reliability achieved by a single device is not acceptable, improvement can be achieved through redundancy, e.g.

duplication of equipment. Two complete, independent, main protection systems are provided, and arranged so that either by itself can carry out the required function. If the probability of each equipment failing is x/unit, the resultant probability of both equipments failing simultaneously, allowing for redundancy, is x2. Where x is small the resultant risk (x2) may be negligible. Where multiple protection systems are used, the tripping signal can be provided in a number of different ways. The two most common methods are:

Time Grading Protection systems in successive zones are arranged to operate in times that are graded through the sequence of equipments so that upon the occurrence of a fault, although a number of protection equipments respond, only those relevant to the faulty zone complete the tripping function. The others make incomplete operations and then reset. The speed of response will often depend on the severity of the fault, and will generally be slower than for a unit system. Unit Systems

All protection systems must operate for a tripping operation to occur (e.g. two-out-of-two arrangement) Only one protection system need operate to cause a trip (e.g. one-outof two arrangement) The former method guards against mal operation while the latter guards against failure to operate due to an unrevealed fault in a protection system. Rarely, three main protection systems are provided, configured in a two-out-of three tripping arrangement, to provide both reliability of tripping, and security against unwanted tripping. It has long been the practice to apply duplicate protection systems to bus bars, both being required to operate to complete a tripping operation. Loss of a bus bar may cause widespread loss of supply, which is clearly undesirable. In other cases, important circuits are provided with duplicate main protection systems, either being able to trip independently. On critical circuits, use may also be made of a digital fault simulator to model the relevant section of the power system and check the performance of the relays used.

It is possible to design protection systems that respond only to fault conditions occurring within a clearly defined zone. This type of protection system is known as 'unit protection'. Certain types of unit protection are known by specific names, e.g. restricted earth fault and differential protection. Unit protection can be applied throughout a power system and, since it does not involve time grading, is relatively fast in operation. The speed of response is substantially independent of fault severity. Unit protection usually involves comparison of quantities at the boundaries of the protected zone as defined by the locations of the current transformers. This comparison may be achieved by direct hard-wired connections or may be achieved via a communications link. However certain protection systems derive their 'restricted' property from the configuration of the power system and may be classed as unit protection, e.g. earth fault protection applied to the high voltage delta winding of a power transformer. Whichever method is used, it must be kept in mind that selectivity is not merely a matter of relay design. It also depends on the correct coordination of current transformers and relays with a suitable choice of relay

settings, taking into account the possible range of such variables as fault currents, maximum load current, system impedances and other related factors, where appropriate. STABILITY The term stability is usually associated with unit protection schemes and refers to the ability of the protection system to remain unaffected by conditions external to the protected zone, for example through load current and external fault conditions. SPEED The function of protection systems is to isolate faults on the power system as rapidly as possible. The main objective is to safeguard continuity of supply by removing each disturbance before it leads to widespread loss of synchronism and consequent collapse of the power system. As the loading on a power system increases, the phase shift between voltages at different bus bars on the system also increases, and therefore so does the probability that synchronism will be lost when the system is disturbed by a fault. The shorter the time a fault is allowed to remain in the system, the greater can be the loading of the system. Figure 5 shows typical relations between system loading and fault clearance times for various types of fault. It will be noted that phase faults have a more marked effect on the stability of the system than a simple earth fault and therefore require faster clearance.

Fig 5 System stability is not, however, the only consideration. Rapid operation of protection ensures that fault damage is minimised, as energy liberated during a fault is proportional to the square of the fault current times the duration of the fault. Protection must thus operate as quickly as possible but speed of operation must be weighed against economy. Distribution circuits, which do not normally require a fast fault clearance, are usually protected by time-graded systems. Generating plant and EHV systems require protection gear of the highest attainable speed; the only limiting factor will be the necessity for correct operation, and therefore unit systems are normal practice. SENSITIVITY Sensitivity is a term frequently used when referring to the minimum operating level (current, voltage, power etc.) of relays or complete protection schemes. The relay or scheme is said to be sensitive if the primary operating parameter(s) is low. With older electromechanical relays, sensitivity was considered in terms of the sensitivity of the measuring movement and was measured in terms of its volt-ampere consumption to cause operation. With modern digital and numerical relays the achievable sensitivity is seldom limited by the device design but by its application and CT/VT parameters.

PRIMARY PROTECTION

AND

BACK-UP For EHV systems, where system stability is at risk unless a fault is cleared quickly, multiple primary protection systems, operating in parallel and possibly of different types (e.g. distance and unit protection), will be used to ensure fast and reliable tripping. Back up over current protection may then optionally be applied to ensure that two separate protection systems are available during maintenance of one of the primary protection systems. Back-up protection systems should, ideally, be completely separate from the primary systems. For example a circuit protected by a current differential relay may also have time graded over current and earth fault relays added to provide circuit breaker tripping in the event of failure of the main primary unit protection. To maintain complete separation and thus integrity, current transformers, voltage transformers, relays, circuit breaker trip coils and d.c. Supplies would be duplicated. This ideal is rarely attained in practice. The following compromises are typical: Separate current transformers (cores and secondary windings only) are provided. This involves little extra cost or accommodation compared with the use of common current transformers that would have to be larger because of the combined burden. This practice is becoming less common when digital or numerical relays are used, because of the extremely low input burden of these relay types Voltage transformers are not duplicated because of cost and space considerations. Each protection relay supply is separately protected (fuse or MCB) and continuously supervised to ensure security of the VT output. An alarm is given on failure of the supply and, where appropriate, prevent an unwanted operation of the protection

The reliability of a power system has been discussed earlier, including the use of more than one primary (or main) protection system operating in parallel. In the event of failure or non-availability of the primary protection some other means of ensuring that the fault is isolated must be provided. These secondary systems are referred to as back-up protection. Back-up protection may be considered as either being local or remote. Local back-up protection is achieved by protection which detects an un-cleared primary system fault at its own location and which then trips its own circuit breakers, e.g. time graded over current relays. Remote back-up protection is provided by protection that detects an un-cleared primary system fault at a remote location and then issues a local trip command, e.g. the second or third zones of a distance relay. In both cases the main and back-up protection systems detect a fault simultaneously, operation of the back-up protection being delayed to ensure that the primary protection clears the fault if possible. Normally being unit protection, operation of the primary protection will be fast and will result in the minimum amount of the power system being disconnected. Operation of the back-up protection will be, of necessity, slower and will result in a greater proportion of the primary system being lost. The extent and type of back-up protection applied will naturally be related to the failure risks and relative economic importance of the system. For distribution systems where fault clearance times are not critical, time delayed remote back-up protection may be adequate.

Trip supplies to the two protections should be separately protected (fuse or MCB). Duplication of tripping batteries and of circuit breaker tripping coils may be provided. Trip circuits should be continuously supervised It is desirable that the main and back-up protections (or duplicate main protections) should operate on different principles, so that unusual events that may cause failure of the one will be less likely to affect the other. Digital and numerical relays may incorporate suitable back-up protection functions (e.g. a distance relay may also incorporate time-delayed over current protection elements as well). A reduction in the hardware required to provide back-up protection is obtained, but at the risk that common relay element failure (e.g. the power supply) will result in simultaneous loss of both main and back-up protection. The acceptability of this situation must be evaluated on a case-by-case basis. RELAY OUTPUT DEVICES In order to perform their intended function, relays must be fitted with some means of providing the various output signals required. Contacts of various types usually fulfill this function. Contact Systems Relays may be fitted with a variety of contact systems for providing electrical outputs for tripping and remote indication purposes. The most common types encountered are as follows: a. Self-reset The contacts remain in the operated condition only while the controlling quantity is applied, returning to their original condition when it is removed

b. Hand or electrical reset These contacts remain in the operated condition after the controlling quantity is removed. They can be reset either by hand or by an auxiliary electromagnetic element The majority of protection relay elements have self-reset contact systems, which, if so desired, can be modified to provide hand reset output contacts by the use of auxiliary elements. Hand or electrically reset relays are used when it is necessary to maintain a signal or lockout condition. Contacts are shown on diagrams in the position corresponding to the unoperated or de energised condition, regardless of the continuous service condition of the equipment. For example, an under voltage relay, which is continually energised in normal circumstances, would still be shown in the de energised condition. A 'make' contact is one that closes when the relay picks up, whereas a 'break' contact is one that is closed when the relay is de-energised and opens when the relay picks up. Examples of these conventions and variations are shown in Figure 6.

Fig 6 A protection relay is usually required to trip a circuit breaker, the tripping mechanism of which may be a solenoid with a plunger acting directly on the mechanism latch or an electrically operated valve. The power required by the trip coil of the circuit breaker may

range from up to 50 watts for a small 'distribution' circuit breaker, to 3000 watts for a large, extra-high voltage circuit breaker. The relay may therefore energise the tripping coil directly, or, according to the coil rating and the number of circuits to be energised, may do so through the agency of another multi-contact auxiliary relay. The basic trip circuit is simple, being made up of a hand trip control switch and the contacts of the protection relays in parallel to energise the trip coil from a battery, through a normally open auxiliary switch operated by the circuit breaker. This auxiliary switch is needed to open the trip circuit when the circuit breaker opens since the protection relay contacts will usually be quite incapable of performing the interrupting duty. The auxiliary switch will be adjusted to close as early as possible in the closing stroke, to make the protection effective in case the breaker is being closed on to a fault. Where multiple output contacts, or contacts with appreciable currentcarrying capacity are required, interposing, contactor type elements will normally be used. In general, static and microprocessor relays have discrete measuring and tripping circuits, or modules. The functioning of the measuring modules is independent of operation of the tripping modules. Such a relay is equivalent to a sensitive electromechanical relay with a tripping contactor, so that the number or rating of outputs has no more significance than the fact that they have been provided. For larger switchgear installations the tripping power requirement of each circuit breaker is considerable, and further, two or more breakers may have to be tripped by one protection system. There may also be remote signalling requirements,

interlocking with other functions (for example auto-reclosing arrangements), and other control functions to be performed. These various operations may then be carried out by multi contact tripping relays, which are energised by the protection relays and provide the necessary number of adequately, rated output contacts. Operation Indicators Protection systems are invariably provided with indicating devices, called 'flags', or 'targets', as a guide for operations personnel. Not every relay will have one, as indicators are arranged to operate only if a trip operation is initiated. Indicators, with very few exceptions, are bi-stable devices, and may be either mechanical or electrical. A mechanical indicator consists of a small shutter that is released by the protection relay movement to expose the indicator pattern. Electrical indicators may be simple attracted armature elements, where operation of the armature releases a shutter to expose an indicator as above, or indicator lights (usually light emitting diodes). For the latter, some kind of memory circuit is provided to ensure that the indicator remains lit after the initiating event has passed. With the advent of digital and numerical relays, the operation indicator has almost become redundant. Relays will be provided with one or two simple indicators that indicate that the relay is powered up and whether an operation has occurred. The remainder of the information previously presented via indicators is available by interrogating the relay locally via a man machine interface (e.g. a keypad and liquid crystal display screen), or remotely via a communication system.

TRIPPING CIRCUITS There are three main circuits in use for circuit breaker tripping: a. Series sealing b. Shunt reinforcing c. Shunt reinforcement with sealing These are illustrated in Figure 7

as mentioned previously. The making current of the relay output contacts and the need to avoid these contacts breaking the trip coil current largely dictates circuit breaker trip coil arrangements. Comments on the various means of providing tripping arrangements are, however, included below as a historical reference applicable to earlier electromechanical relay designs. Series sealing The coil of the series contactor carries the trip current initiated by the protection relay, and the contactor closes a contact in parallel with the protection relay contact. This closure relieves the protection relay contact of further duty and keeps the tripping circuit securely closed, even if chatter occurs at the main contact. The total tripping time is not affected, and the indicator does not operate until current is actually flowing through the trip coil. The main disadvantage of this method is that such series elements must have their coils matched with the trip circuit with which they are associated. The coil of these contacts must be of low impedance, with about 5% of the trip supply voltage being dropped across them. When used in association with high-speed trip relays, which usually interrupt their own coil current, the auxiliary elements must be fast enough to operate and release the flag before their coil current is cut off. This may pose a problem in design if a variable number of auxiliary elements (for different phases and so on) may be required to operate in parallel to energise a common tripping relay.

Fig 7 For electromechanical relays, electrically operated indicators, actuated after the main contacts have closed, avoid imposing an additional friction load on the measuring element, which would be a serious handicap for certain types. Care must be taken with directly operated indicators to line up their operation with the closure of the main contacts. The indicator must have operated by the time the contacts make, but must not have done so more than marginally earlier. This is to stop indication occurring when the tripping operation has not been completed. With modern digital and numerical relays, the use of various alternative methods of providing trip circuit functions is largely obsolete. Auxiliary miniature contactors are provided within the relay to provide output contact functions and the operation of these contactors is independent of the measuring system,

Shunt reinforcing Here the sensitive contacts are arranged to trip the circuit breaker and simultaneously to energise the auxiliary unit, which then reinforces the contact that is energising the trip coil. Two contacts are required on the protection relay, since it is not permissible to energise the trip coil and the reinforcing contactor in parallel. If this were done, and more than one protection relay were connected to trip the same circuit breaker, all the auxiliary relays would be energised in parallel for each relay operation and the indication would be confused. The duplicate main contacts are frequently provided as a three-point arrangement to reduce the number of contact fingers. Shunt reinforcement with sealing This is a development of the shunt reinforcing circuit to make it applicable to situations where there is a possibility of contact bounce for any reason. Using the shunt reinforcing system under these circumstances would result in chattering on the auxiliary unit, and the possible burning out of the contacts, not only of the sensitive element but also of the auxiliary unit. The chattering would end only when the circuit breaker had finally tripped. The effect of contact bounce is countered by means of a further contact on the auxiliary unit connected as a retaining contact. This means that provision must be made for releasing the sealing circuit when tripping is complete; this is a disadvantage, because it is sometimes

inconvenient to find a suitable contact to use for this purpose. TRIP CIRCUIT SUPERVISION The trip circuit includes the protection relay and other components, such as fuses, links, relay contacts, auxiliary switch contacts, etc., and in some cases through a considerable amount of circuit wiring with intermediate terminal boards. These interconnections, coupled with the importance of the circuit, result in a requirement in many cases to monitor the integrity of the circuit. This is known as trip circuit supervision. The simplest arrangement contains a healthy trip lamp, as shown in Figure 8(a).

Fig 8 The resistance in series with the lamp prevents the breaker being tripped by an internal short circuit caused by failure of the lamp. This provides supervision while the circuit breaker is closed; a simple extension gives preclosing supervision.

Figure 8(b) shows how, the addition of a normally closed auxiliary switch and a resistance unit can provide supervision while the breaker is both open and closed. In either case, the addition of a normally open pushbutton contact in series with the lamp will make the supervision indication available only when required. Schemes using a lamp to indicate continuity are suitable for locally controlled installations, but when control is exercised from a distance it is necessary to use a relay system. Figure 8(c) illustrates such a scheme, which is applicable wherever a remote signal is required. With the circuit healthy, either or both of relays A and B are operated and energise relay C. Both A and B must reset to allow C to drop-off. Relays A, B and C are time delayed to prevent spurious alarms during tripping or closing operations. The resistors are mounted separately from the relays and their values are chosen such that if any one component is inadvertently shortcircuited, tripping will not take place. The alarm supply should be independent of the tripping supply so that indication will be obtained in case of failure of the tripping supply. The above schemes are commonly known as the H4, H5 and H7 schemes, arising from the diagram references of the Utility specification in which they originally appeared. Figure 8(d) shows implementation of scheme H5 using the facilities of a modern numerical relay. Remote indication is achieved through use of programmable logic and additional auxiliary outputs available in the protection relay.